Attendees of the recent Black Hat and Def Con cybersecurity conferences are being warned to watch for persistent phishing attempts following a campaign that targeted a security researcher. The attacker employed multiple tactics, including social media direct messages, malicious Google Docs, and fake file-sharing installers, to deliver various malware payloads.
The campaign began with an attacker impersonating a CoinDesk VP and head of marketing, contacting a security researcher on X (formerly Twitter) to solicit help for a supposed upcoming conference. Although the researcher identified the initial contact as a scam, they engaged to observe the attacker's methods.
The attacker subsequently sent a Google Doc, presented as a conference planning document. This document was designed to be more than a typical phishing lure. When opened by an authenticated Google user, it displayed a custom Google Apps Script sidebar. This sidebar prompted the user to enter an "encryption key" provided by the attacker, which would appear to fail. It then offered two follow-on options: "ClickFix"-style instructions and a download option, both intended to deliver malicious code.
When this initial attempt failed, the attacker pivoted the next day, sending a new lure disguised as a Dropbox DocSend share. This led to a counterfeit DocSend installer. The installer delivered different payloads depending on the victim's operating system. For macOS users, it deployed AMOS, an infostealer. For Windows users, it installed an implant designed to steal cryptocurrency from Ledger wallets, along with a traffic-intercepting proxy intended to help the malware evade security software and VirusTotal checks.
The attacker's persistence continued even after these attempts, with a new proposition offering up to $1 million in funding. This was hypothesized to be another pretext to steal credentials or personally identifiable information.
Security experts advise conference attendees to be vigilant for legitimate-looking messages that lead to documents or installers requiring actions that security controls would typically prevent. Unexpected requests to run terminal commands, bypass Gatekeeper, install manual updates, or enter device passwords are strong indicators of a compromise attempt.
Users who may have interacted with such messages are advised to immediately isolate the affected system from the network, collect forensic evidence, and consider reimaging the system. It is also recommended to assume that credentials have been compromised, revoke active sessions, reset passwords, and rotate API keys or any other secrets residing on the system. Additionally, cryptocurrency wallet activity should be reviewed if relevant.
